EUVD-2026-93588
GHSA-7cvx-ch6c-385h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to Windows device
-
ExploitInteract with vulnerable Chrome CredentialProvider
-
ExecutionExploit missing authorization check
-
ImpactRead sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires direct PHYSICAL access to a Windows host running Chrome prior to 155.0.8059.39, with interaction against the Chrome CredentialProvider component that is missing an authorization check. Exploitation is strictly local and physical (CVSS AV:P): it cannot be performed over a network or remotely, cannot be automated or scaled (SSVC Automatable=no), and no special software configuration is named in the advisory beyond running an affected Chrome version on Windows. The physical-presence requirement is the dominant limiting factor, confining realistic risk to shared, kiosk, lost/stolen, or otherwise physically-exposed devices. |
| Impact | This is a genuinely LOW-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) requires PHYSICAL access to the device - the single most limiting attack vector - which caps real-world risk despite the HIGH confidentiality impact. Chromium itself rated this 'Low'. The SSVC decision framework reinforces this: Exploitation=none (no observed activity), Automatable=no (physical presence cannot be scripted at scale), and Technical Impact=partial. There is no CISA KEV listing and no public POC identified, so this is not actively exploited. No EPSS score was provided in the input; given the physical-access requirement, a low EPSS would be expected and would not conflict with any other signal. The description ('physical access') and the CVSS AV:P value agree - no vector mismatch to flag. Bottom line: a legitimately low-risk, high-CVSS-only-on-paper issue that does not warrant emergency patching but should be picked up in normal Chrome update cycles, especially for shared or kiosk Windows machines. |
| Exploit ScenarioDerived | An attacker with hands-on physical access to an unlocked or accessible Windows machine running a vulnerable Chrome build interacts with the CredentialProvider component, which fails to enforce an authorization check, and reads sensitive information they should not be able to access. No public exploit code has been identified, and the attack cannot be performed remotely or automated - it requires the attacker to be physically at the device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Missing authorization in the CredentialProvider component of Google Chrome on Windows (versions prior to 155.0.8059.39) lets an attacker with direct physical access to the machine read sensitive credential data. The vulnerability is strictly local and physical - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - so it cannot be triggered over a network, cannot be automated (SSVC Automatable=no), and carries no integrity or availability impact, only confidentiality. CISA's SSVC assessment rates exploitation as none and no public exploit code or in-the-wild activity has been identified at time of analysis, keeping overall risk genuinely low and confined to shared, kiosk, loaner, or lost/stolen Windows devices.
RemediationAI
Upgrade Google Chrome on Windows to 155.0.8059.39 or later, which the vendor advisory confirms as the fixed build; Chrome's auto-update mechanism will normally pull this release, but verify the version via chrome://version and force an update where auto-update is disabled or managed by policy. The vendor-released patch is available per the Chrome stable channel release notes at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html, with technical detail in https://issues.chromium.org/issues/503794852. No patch-level workaround is documented, because the attack requires direct physical access: the practical compensating controls are therefore physical and environmental rather than configuration-based, such as enabling Windows lock-screen timeouts and requiring re-authentication so an unattended machine cannot be physically manipulated, restricting kiosk, lab, and loaner devices to non-privileged guest profiles to limit what credential material is reachable through the browser, and storing such devices in controlled locations. These measures reduce exposure but do not remove the underlying flaw, so patching remains the only complete fix; be aware that tightening session lock and guest-profile policies can affect usability on shared workstations and should be assessed alongside existing IT policy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CredentialProvider is the Windows-side interface through which applications such as Chrome integrate with the operating system's credential management and logon/credential-acquisition flows. CWE-862 (Missing Authorization) indicates the component performs an action or exposes data without first verifying that the caller is entitled to it; here the missing check lets a local actor with physical presence reach credential material that should have been protected by an authorization gate. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with the referenced fixed build 155.0.8059.39 identifies the affected surface as Chrome's own credential-provider integration on Windows rather than the browser core renderer. Because the attack vector is physical (AV:P), exploitation requires hands-on interaction with a running, affected Chrome installation on a Windows host; there is no remote or lateral-attack path described, and the advisory (Chromium issue 503794852, rated Chromium security severity Low) does not identify any special configuration beyond running a pre-155.0.8059.39 build.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Physical access is required so AV:P; no privileges or user interaction are needed (PR:N/UI:N); the missing authorization discloses data only, giving C:H with I:N/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via physical access. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB